hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/tree/master/Pony

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Pony

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
72	raw.githubusercontent.com
73	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 512354.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
4908	msedge.exe
4908	msedge.exe
1688	identity_helper.exe
1688	identity_helper.exe
5304	msedge.exe
5304	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4532	4908	msedge.exe	83
PID 4908 wrote to memory of 4532	4908	msedge.exe	83
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 1224	4908	msedge.exe	84
PID 4908 wrote to memory of 3208	4908	msedge.exe	85
PID 4908 wrote to memory of 3208	4908	msedge.exe	85
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86
PID 4908 wrote to memory of 2212	4908	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/Pony
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9568446f8,0x7ff956844708,0x7ff956844718
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,14264943993764832624,15487788301517984596,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault04182164h4eb7h4ca7ha3d2h88649921ef52
1⤵
PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9568446f8,0x7ff956844708,0x7ff956844718
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,2199959321132841253,14220664816762697252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,2199959321132841253,14220664816762697252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a5d3a0ba05be936d89a0764472df392e

SHA1
60416e244b680311d13da00d3fffb0c8a8a19717

SHA256
17466a8e21b4c099ac0290b4343794603ef342fc4111336fefe785f594755af1

SHA512
937bbffdacaccd66583adc88bde15de048dfb832e557bf0a2648f3d6a3fa5d5290d0d3a7c22b7e8267968e31b78eb6451f40e8ec23db54314f4f35de74eeaa5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
75237b876e4ebf0cf587313ae92b7952

SHA1
ef712d6b1e678d091b39cd593b8d4a2a5520f139

SHA256
d7abd571a35eaba20a7c57d7ac93cbb59b8d4b417f4b67590ee1c29ff561442b

SHA512
0c96b1f590a69141018c2112e36de65fb30ab57320b4b76da3a672b23c716197fc06e0f381491975319a8ad4ae138660469d3149cfbb69be96a2cfdfcaf802b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cac110917bfaf9cf473f5ddd3acdfcfb

SHA1
ba61fdbc96f32afba674ad4c541b522a4d4e7c8a

SHA256
2b6b2549c2905295016a4163a5b2d76d75d5cf9cd945948b95735c5b338486cd

SHA512
04315fd1160318bf3a94a6375925ad273dc44618998face3ffdf9f048d080a73a08691c18954d9f4c79828d16e3c82dbd1e2a183c0bb2c8d47d6d401f3097ada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b2883daef2b4f4169eb0a8d7a9d53368

SHA1
0dcbded9094801881fa28c3865639ce54092f4e3

SHA256
b39581395d26b3a76d0474417cb8d10feffdd84a9c72ecea43895686871df544

SHA512
ba7ca5694d1cb3a245eac279ac565e3d14fc8a2ad73c347c2558af570fe1d90a8a7e1c88468303b34cc35fffbff23a880895cbc225f7043f071ac2217fd7a815

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
52c148d611046f86d37ad77dca8c9c3f

SHA1
3a797a205255e48fc0c358d08222a9a9ba59ae8f

SHA256
331fb7d46c1536d8bc46918eb46f3952e4ab8b4f5260040886c006025c3fee80

SHA512
d10f2ec47bd86d096df02a22e49c7526f8be9c843615ebface3716297c58cc270ce60b8a0dec1053ac372ff6be368c51431ee6b598a8463537afc8a3fb8482b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
92141ed14645cbc67aa22937c414662b

SHA1
0b4f442fb01cbab24f299f9b220b18c01d404092

SHA256
3a9fd413ce2b557aeb997db5ca0164c2b9c5f47aaf4a18b1fbbc626517b7f55e

SHA512
d133071d0f3df33b60db7eedef7168b1559ce83554ba657f9a99e1835e731d919a96f8a468859bb60543a9ce7e132108fd84163fa3ec8728fbd290330451d676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
e62404012a7bce391bff07391d45a32b

SHA1
28d610b7d9316bdea162200371a3aaa3be9fcc7e

SHA256
d77edc5d0875b5b6b6123429565a54a70f570794584adbe8a7e9853b23cdab3f

SHA512
e495ed5d74dce96c83b9dcc0e6090e4360e882ebfc262a60218860b7f8123ec13523c80854ea39b48918c003799d133c9d25b7be81c7ab76c754b359814ebc1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
559f20ac311288e2df5cfee8b5e98a77

SHA1
0e904a91c4d5bb49304628b7384eab2c5bf7a398

SHA256
849705fd1dfb62979b4ea5cc70973fa063c2660474cdd898ee1d440a4994b388

SHA512
34a14eb2f72c57324a4758522ff7f12fb258a32650d45dd859d62f834fa6fd24ee557c8d0aeeb48ff6762d48c818374aaba675be3bd7d3c08ea01837dc950825

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
abfdbf665ce3ff543122e5cb395ffa91

SHA1
b985ca1d8eb4e80f335ed5115e04197a97eea8fb

SHA256
af3c47b856b9d5fa6c6aa0feeb47ebe6826baf29d04f5ed71dbb6bb9b0411f72

SHA512
50756cc97535fabde776f9119118312942343d648a6daa55f900a8518e87d20f9791e8722074e0c7c1c76425e3cedb5ba5f87dff4c27b4dcc19c93ebaa1f090e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e35b.TMP

Filesize
874B

MD5
2ff141673c13c12825d538bd9d39fdda

SHA1
0ad2ccea8d0c9ca5192b7ccd17d5c44c166b88f8

SHA256
63bfd9f958f45770578f5c4d498e6f298fa47c5db8af4718938cf416529b3c8f

SHA512
d8fdb348a339e5ddfff4ecb449041d7a321bc902e9a9486b32d328c85495b6d7fe38f538be3b33a2063a68e2d28c5d4186f18876c6382d332dc398d4f03e111b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
17606f43595b87382690f042535d8a84

SHA1
7f97a1cb50de5d9cd86c3184e3a3b27fcbca2d38

SHA256
c92004767934ee7256fce2f9dd50ec57df936a015b65cbf723fb233b36b043ea

SHA512
6275b2cdd10c71420aa99c0e1042457feebc17734935ea1d3942853cc41bc23eb295d8009f6258437f403789a99de07faadc0cf377d481aa865184e2910bf1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
16db21feb87d50a12ce2e70a20cf2692

SHA1
e20d3b65101d05c5dc0bfaa7c2a3452176f78cbb

SHA256
0c9109820906418c16062fc2532f2283321594343f9d33600ff736190710bed8

SHA512
283a6a6a0a444c3bda78f0dbd7715701378b90638ef0a94cfb73ee6f901c9ff46683fc04080357c1b05561ccaad20c55fb78843a55ca8e045fc82b07d6784f25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
40152be0d5affe0f2537f70780f8c6bd

SHA1
734e9d31b062ed42270306379c0d72e11dde6fc8

SHA256
9d887fca8e8a0b2b28d46fcebac7309a049dca4b03667df58fd15f82f59c7f99

SHA512
c9d2802db825b639e84cb7e5a20173078e4c71bd71389a375a8553594efb423b9eb8fb39f22b577c065772469eb906f36eeec5c102b4a2a8abdbd9189518fb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
23cee81ca208ac8d8ef3b049f388f4f7

SHA1
d693659bad560b5f36d13d828d11115ae4082506

SHA256
c95374d078a861d87929b93cdcefc5d3f2435fb5a69366a90daf80b94c642fd9

SHA512
fc744d9660318d14a2727e74b720688ec583856260d64b35b9cfd1c21558d53fe08c48e5b333eb4ca64d4bd9515fe0def8d5856a4086145dfd3a6ccafcd59566

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 512354.crdownload

Filesize
1.0MB

MD5
055d1462f66a350d9886542d4d79bc2b

SHA1
f1086d2f667d807dbb1aa362a7a809ea119f2565

SHA256
dddf7894b2e6aafa1903384759d68455c3a4a8348a7e2da3bd272555eba9bec0

SHA512
2c5e570226252bdb2104c90d5b75f11493af8ed1be8cb0fd14e3f324311a82138753064731b80ce8e8b120b3fe7009b21a50e9f4583d534080e28ab84b83fee1

Download Submit